Open-source alternatives to Linux Smart Enumeration

This project is a security auditing tool and vulnerability scanner designed to evaluate the security posture of Linux hosts. It functions as a privilege escalation auditor that scans running kernels for missing security patches and vulnerabilities to identify potential paths for gaining root access. The utility performs kernel security analysis by matching system version strings against a database of known exploits. It audits kernel hardening settings and evaluates system exposure to categorize the probability of successful privilege escalation attacks. The tool covers a broad range of asses

LinEnum is a suite of security utilities for auditing Linux systems, scanning for privilege escalation paths, and enumerating local vulnerabilities. It functions as a system security audit tool, a local enumeration utility, and a scanner for identifying misconfigurations that could allow a user to gain root access. The project includes specialized auditing for containerized environments, specifically detecting Docker and LXC signatures to identify potential escape vectors to the host system. Its broader capabilities cover the analysis of kernel versions, the identification of SUID binaries a

This project is a post-exploitation framework and privilege escalation script suite designed to scan local system configurations for security gaps. It serves as a system enumeration toolset used to identify paths for gaining higher administrative privileges on a target host. The suite incorporates capabilities for security penetration testing and vulnerability assessment reporting. It uses shell-based system enumeration and pattern-based vulnerability matching to detect misconfigurations, while employing heuristic-based permission analysis to evaluate system flags. Findings are gathered thro

BloodHound is an identity risk management platform and graph-based attack path analyzer used to map identity relationships and permissions in Active Directory. It functions as a security tool for auditing directory services, uncovering unintended privilege relationships, and visualizing sequences of permissions that can lead to domain compromise. The project differentiates itself as a comprehensive adversary emulation framework that coordinates remote agents and executes post-exploitation commands. It includes a reverse proxy for bypassing multi-factor authentication via real-time session hij

HackTools is a browser extension pentesting toolkit designed for offensive security professionals. It serves as a centralized collection of tools for generating payloads, managing penetration testing workflows, and accessing security reference materials within a web-based interface. The project provides specialized utilities for generating attack strings for XSS, SQL injection, and reverse shells to identify and exploit web vulnerabilities. It includes a data encoding and hashing utility to convert information between various formats for the purpose of bypassing security filters or verifying

The openvas-scanner is a vulnerability scanner designed to identify security weaknesses and outdated software in target systems. It performs network vulnerability scanning by executing security tests and network attack scripts, as well as conducting local security auditing through static version checks of installed software. The project utilizes community-managed feeds to synchronize and update local security definitions and vulnerability tests. These tests and scan configurations are loaded into the system via container images or manual transfers and stored in a persistent relational databas

This project is a custom firmware for the Flipper Zero that provides an embedded plugin ecosystem, a hardware pentesting toolkit, and a multi-protocol emulation layer. It modifies the device's operating system to include a Sub-GHz radio suite for expanded frequency range and the ability to build and deploy third-party applications directly onto the hardware. The firmware extends the device's native capabilities through a Sub-GHz radio suite that allows for frequency extension and signal capture beyond factory defaults. It implements specialized emulation for BadUSB and BLE keyboards and inclu

Windows-privesc-check is an automated security auditing tool designed to identify misconfigurations and vulnerabilities that may allow for unauthorized privilege escalation on Windows systems. It functions by scanning local system configurations, including file system permissions, registry settings, and service configurations, to detect security weaknesses that could lead to elevated administrative access. The tool distinguishes itself by providing both local auditing and remote assessment capabilities. It can query remote Windows hosts to enumerate network shares, user accounts, and domain t

WinPwn is a Windows penetration testing framework and security toolkit designed for auditing Active Directory and exploiting Windows environments. It provides a collection of automated tools and scripts for domain enumeration, credential theft, and privilege escalation. The toolkit distinguishes itself through capabilities for neutralizing antimalware scanning interfaces to evade detection and providing offline binary packaging for execution on isolated systems without internet access. It also includes specialized utilities for intercepting and relaying SMB authentication traffic to gain unau

Santa is a binary authorization system for macOS designed to control and monitor which binaries can execute based on defined trust rules. It functions as application whitelisting software that prevents unauthorized programs from running by verifying them against cryptographic hashes and signing certificates. The system provides execution monitoring by recording every binary launch event to create a visible software execution trail. It enables centralized audit logging to track successful and denied application launches across multiple devices, ensuring enterprise device compliance through syn

Procs is a high-performance system process monitor and viewer written in Rust. It serves as a replacement for the ps command, providing a command-line interface to track active system processes and their associated CPU and memory metrics. The tool is distinguished by its container awareness, which maps system tasks to their corresponding Docker container names. It also features an interactive process tree to visualize parent and child relationships in a hierarchical layout and a JSON exporter for programmatic data analysis and automation. The monitoring surface includes real-time activity tr

Vulscan is a network service auditor and vulnerability scanner that utilizes the Nmap Scripting Engine to identify security flaws. It functions as a version-based flaw detector, matching detected software banners against an offline vulnerability database to identify potential security risks without requiring a constant internet connection. The tool provides mechanisms for refining identification accuracy, including an interactive mode for manual version overriding and configurable matching logic to filter results. It manages security data through a system for loading local datasets and synchr

PEASS-ng is an automated penetration testing framework designed to identify privilege escalation vectors on local systems. It functions as a security assessment utility that scans environments for misconfigurations, sensitive files, and insecure permissions to uncover paths for unauthorized privilege elevation. The project distinguishes itself through a modular script-based enumeration engine that adapts to the target environment. It utilizes environment-aware capability detection and cross-platform shell abstraction to normalize data collection across diverse operating systems, while operati

This project is a technical repository of kernel exploit guides, memory corruption analyses, and archived methods for gaining root access. It serves as a centralized library of security flaws and reproduction steps used for testing system protections and verification. The documentation focuses on the Linux kernel, providing technical breakdowns of how memory management errors and multi-page write techniques allow for the modification of read-only files. It details the use of race conditions to achieve administrative privilege escalation. The repository covers a broad surface of security rese

OffensiveRust is a red team toolkit and malware development kit written in Rust. It serves as an evasion framework and post-exploitation library, providing a collection of offensive security primitives and a Windows API wrapper for interacting with low-level system functions and undocumented APIs. The project focuses on bypassing security software through direct system calls, memory obfuscation, and stealthy payload execution. It implements techniques to defeat static binary analysis via compile-time string encryption and payload obfuscation, while avoiding detection using parent process ID s

TacticalRMM is a remote monitoring and management platform designed for overseeing endpoints and automating IT administration. It functions as an endpoint management tool and IT automation framework, providing a centralized dashboard for executing scripts, monitoring system health, and managing remote devices across multiple tenants. The platform distinguishes itself through a comprehensive remote administration suite that includes real-time shell access, remote file management, and registry editing. It integrates with third-party remote desktop software and provides a hierarchical policy inh

Nishang is a PowerShell-based offensive security framework designed for red teaming and penetration testing on Windows targets. It functions as a post-exploitation toolkit and payload generator to automate attacks and manage remote targets. The project provides specialized capabilities for bypassing security controls, such as disabling the Antimalware Scan Interface and employing in-memory execution to avoid disk-based detection. It includes a variety of stealthy command and control mechanisms, utilizing non-standard channels like DNS TXT records, ICMP traffic, and webmail for communication a

Retire.js is a JavaScript vulnerability scanner and dependency security analyzer. It identifies outdated or insecure JavaScript libraries with known security flaws within web applications and local projects. The tool functions as a web security auditing utility that can be used during penetration testing to detect vulnerable scripts on live websites. It supports the generation of Software Bills of Materials using the CycloneDX format to document project dependencies. The system utilizes signature-based library detection and pattern-matching to map identified versions against a JSON-based sec

Empire is a post-exploitation framework and command and control server designed to manage remote access agents. It provides a centralized system for coordinating these agents and executing specialized scripts across target systems. The project functions as a security evasion tool by adapting network communication patterns to bypass firewalls and monitoring tools. It utilizes a multi-language agent runtime and a modular plugin architecture to execute payloads across different operating systems. The framework covers a broad range of operational capabilities, including remote agent orchestratio

This project is a comprehensive web application penetration testing guide and vulnerability research framework. It provides a structured methodology for identifying and exploiting security flaws through a phased approach involving reconnaissance, analysis, and exploitation. The resource is distinguished by its use of a curated methodology framework that links theoretical vulnerability patterns to real-world bug bounty reports and historical exploit examples. It includes a payload-based testing library and a reference system that maps specific vulnerability categories to recommended third-part

K8tools is a multi-stage attack framework that combines memory-only payload execution, credential testing, port forwarding, privilege escalation, and physical USB-based keystroke injection for comprehensive system compromise. At its core, the Ladon PowerShell module loads a multi-function scanner directly into memory, enabling command execution without writing files to disk, while supporting memory-only payload delivery that downloads and runs obfuscated shellcode or PowerShell commands to evade antivirus detection. The framework distinguishes itself through its breadth of integrated capabili

This repository is a library of scripts for automating keystroke injection and executing remote payloads via USB HID devices. It provides a collection of pre-written automation sequences that simulate keyboard input to perform complex tasks on target operating systems. The framework supports cross-platform payloads capable of detecting target operating systems and adapting keyboard layouts for accurate character injection across different regions. It utilizes a staged payload method to download and execute external code from remote servers, extending the functionality of initial scripts. The

Mindmap is a cybersecurity knowledge base and reference library that organizes security tools, frameworks, and methodologies into a visual knowledge map. It functions as a curated directory of cheat sheets and command guides for offensive and defensive security operations, presented as a hierarchical interface with collapsible nodes. The project converts structured markdown files into navigable visual trees to facilitate the study of penetration testing workflows and DevOps learning roadmaps. It also serves as a security compliance framework, providing structured mappings of NIST and ISO 2700

Malware Configuration And Payload Extraction

:palm_tree:Linux、macOS、Windows Kernel privilege escalation vulnerability collection, with compilation environment, demo GIF map, vulnerability details, executable file (提权漏洞合集)

.. SPDX-FileCopyrightText: 2014 Upi Tamminen .. SPDX-FileCopyrightText: 2014-2025 Michel Oosterhof .. .. SPDX-License-Identifier: BSD-3-Clause

Remote Desktop Protocol in Twisted Python